Penetration testing for api service security

Abstract

According to some embodiments, a method comprises: obtaining an application programming interface (API) specification for an API service; performing one or more tests on the API service to determine an amount of deviation between the API service and the API specification; and determining a deviation score based on the amount of deviation between the API service and the API specification. The method may include transmitting the deviation score to a scoring agent.

1 . A system, comprising:
 one or more processors;   one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the system to perform operations comprising:   obtaining an application programming interface (API) specification for an API service;   performing one or more tests on the API service to determine an amount of deviation between the API service and the API specification; and   determining a deviation score based on the amount of deviation between the API service and the API specification.   
     
     
         2 . The system of  claim 1 , the operations further comprising transmitting the deviation score to a scoring agent. 
     
     
         3 . The system of  claim 1 , wherein obtaining the API specification comprises obtaining one or more files containing interface definition language (IDL) specifications for the API service. 
     
     
         4 . The system of  claim 1 , wherein the one or more files containing IDL specifications are obtained from the API service. 
     
     
         5 . The system of  claim 1 , wherein obtaining the API specification comprises dynamically constructing an interface definition language (IDL) specification for the API service based on remote procedure calls (RPCs) with the API service. 
     
     
         6 . The system of  claim 5 , wherein dynamically constructing the IDL specification comprises proxying one or more requests and responses between one or more client applications and the API service. 
     
     
         7 . The system of  claim 1 , wherein performing one or more tests on the API service comprises transmitting one or more penetration tests to the API service. 
     
     
         8 . The system of  claim 1 , wherein performing one or more tests on the API service comprises proxying one or more requests and responses between one or more client applications and the API service. 
     
     
         9 . The system of  claim 1 , the operations further comprising receiving an indication to disable performing one or more tests on the API service. 
     
     
         10 . The system of  claim 9 , wherein determining the deviation score is further based on the indication to disable performing one or more tests on the API service. 
     
     
         11 . A method comprising:
 obtaining an application programming interface (API) specification for an API service;   performing one or more tests on the API service to determine an amount of deviation between the API service and the API specification; and   determining a deviation score based on the amount of deviation between the API service and the API specification.   
     
     
         12 . The method of  claim 11 , further comprising transmitting the deviation score to a scoring agent. 
     
     
         13 . The method of  claim 11 , wherein obtaining the API specification comprises obtaining one or more files containing interface definition language (IDL) specifications for the API service. 
     
     
         14 . The method of  claim 11 , wherein the one or more files containing IDL specifications are obtained from the API service. 
     
     
         15 . The method of  claim 11 , wherein obtaining the API specification comprises dynamically constructing an interface definition language (IDL) specification for the API service based on remote procedure calls (RPCs) with the API service. 
     
     
         16 . The method of  claim 15 , wherein dynamically constructing the IDL specification comprises proxying one or more requests and responses between one or more client applications and the API service. 
     
     
         17 . The method of  claim 11 , wherein performing one or more tests on the API service comprises transmitting one or more penetration tests to the API service. 
     
     
         18 . The method of  claim 11 , wherein performing one or more tests on the API service comprises proxying one or more requests and responses between one or more client applications and the API service. 
     
     
         19 . The method of  claim 11 , further comprising receiving an indication to disable performing one or more tests on the API service. 
     
     
         20 . The method of  claim 19 , wherein determining the deviation score is further based on the indication to disable performing one or more tests on the API service.